View Full Fortinet NSE4_FGT-7.0 Exam Dumps and Practice Test Dumps

 

Question 281. Which FortiGate feature allows administrators to separate routing, firewall policies, and administrative access into independent virtual environments?

1. VDOM
2. Service group
3. IP pool
4. Traffic shaper

Correct Answer: 1. VDOM

Explanation :-

Virtual domains, or VDOMs, allow a single FortiGate appliance to operate as multiple logically independent firewall environments. Each VDOM can have its own interfaces, routing configuration, firewall policies, and administrative permissions according to the configured deployment. Service groups combine service objects, IP pools provide addresses for source NAT, and traffic shapers control bandwidth. VDOMs are therefore appropriate when organizations need to maintain separate logical firewall environments on the same physical FortiGate device.

Question 282. Which FortiGate command is most appropriate for viewing the currently installed routes and their associated interfaces?

1. diagnose sys session list
2. get router info routing-table all
3. execute ping
4. get system status

Correct Answer: 2. get router info routing-table all

Explanation :-

The get router info routing-table all command displays routes known to and installed on the FortiGate, including information about destination networks and forwarding interfaces or next hops. This is particularly useful when troubleshooting connectivity or verifying that a required route exists. The session-list command displays active sessions, ping tests reachability, and system status provides general device information. Therefore, when the administrator needs to inspect the routing table itself, the routing-table command is the most appropriate choice.

Question 283. Which FortiGate feature can identify and block applications such as peer-to-peer file sharing or unauthorized messaging services?

1. Application Control
2. Static route
3. DHCP relay
4. IP pool

Correct Answer: 1. Application Control

Explanation :-

Application Control identifies applications using FortiGate application signatures and traffic characteristics. Administrators can configure actions for specific applications or application categories, including blocking or monitoring peer-to-peer applications, messaging services, and other unwanted traffic. Static routes determine forwarding paths, DHCP relay forwards DHCP requests, and IP pools provide addresses for source NAT. Application Control is therefore the appropriate security feature when access needs to be controlled according to application identity rather than simply destination port.

Question 284. Which FortiGate feature allows an administrator to inspect the certificate information of an encrypted HTTPS connection without fully decrypting its payload?

1. Deep inspection
2. Certificate inspection
3. Traffic shaping
4. Antivirus

Correct Answer: 2. Certificate inspection

Explanation :-

Certificate inspection allows FortiGate to inspect information contained in SSL/TLS certificates and sessions without performing the full payload decryption associated with deep inspection. This can provide visibility into certificate-related information while avoiding the more extensive requirements of full SSL/TLS content inspection. Deep inspection decrypts supported traffic for deeper inspection, traffic shaping manages bandwidth, and Antivirus detects malware in supported content. Certificate inspection is therefore appropriate when certificate-level visibility is required without full content decryption.

Question 285. Which FortiGate feature can provide source NAT using a predefined range of public IP addresses?

1. Virtual IP
2. IP pool
3. Address group
4. Loopback interface

Correct Answer: 2. IP pool

Explanation :-

An IP pool provides one or more predefined IP addresses that FortiGate can use for source NAT. This allows translated outbound traffic to use addresses from the configured pool rather than automatically using the outgoing interface address. A virtual IP generally performs destination NAT for inbound traffic, an address group combines network objects, and a loopback interface provides a logical endpoint. IP pools are therefore appropriate when outbound translated connections need to use a specified public address or range.

Question 286. Which FortiGate feature can group several service objects so they can be referenced by one firewall policy entry?

1. User group
2. Address group
3. Service group
4. Security profile group

Correct Answer: 3. Service group

Explanation :-

A service group combines multiple service objects into one logical collection. A firewall policy can reference the service group instead of listing every individual service separately. User groups combine authenticated users, address groups combine network addresses, and security profile groups combine security inspection profiles. Service groups are therefore useful when several protocols or port definitions should receive the same firewall-policy treatment and administrators want to simplify policy configuration.

Question 287. Which FortiGate feature can provide failover between FortiGate appliances by using FGCP to monitor cluster members?

1. High Availability
2. Web Filter
3. DNS Filter
4. Application Control

Correct Answer: 1. High Availability

Explanation :-

FortiGate High Availability uses FGCP to allow multiple FortiGate appliances to operate as a cluster. Cluster members exchange heartbeat information and monitor each other’s status so that a suitable member can assume the active role when a failure occurs. Web Filter, DNS Filter, and Application Control are security inspection features and do not provide appliance-level failover. High Availability is therefore the appropriate FortiGate capability when redundancy and automatic failover between firewall appliances are required.

Question 288. Which FortiGate setting determines which management protocols are allowed through a specific interface?

1. Firewall address
2. Administrative access
3. Security profile
4. Policy route

Correct Answer: 2. Administrative access

Explanation :-

Administrative access settings determine which management services can be reached through a FortiGate interface. Depending on the configuration, protocols such as HTTPS, SSH, HTTP, SNMP, or PING can be enabled or disabled. Firewall addresses define network objects, security profiles inspect traffic, and policy routes control forwarding decisions. Administrative access is therefore the correct setting to review when an administrator needs to determine whether a particular management protocol is available on an interface.

Question 289. Which FortiGate command can be used to test whether the firewall can reach a remote IP address using ICMP?

1. show firewall policy
2. execute ping
3. diagnose debug flow
4. get system status

Correct Answer: 2. execute ping

Explanation :-

The execute ping command sends ICMP echo requests from the FortiGate toward a specified IP address. It is commonly used as a basic connectivity test to determine whether a destination can be reached through the current routing and interface configuration. show firewall policy displays policy configuration, diagnose debug flow provides detailed packet-processing information, and get system status displays general system information. Therefore, execute ping is the appropriate first-level tool for testing basic IP reachability.

Question 290. Which FortiGate feature can forward logs to a centralized external log-analysis platform specifically designed for Fortinet devices?

1. FortiAnalyzer
2. DHCP server
3. IP pool
4. ECMP

Correct Answer: 1. FortiAnalyzer

Explanation :-

FortiAnalyzer provides centralized collection, storage, analysis, and reporting for logs generated by Fortinet devices. FortiGate can forward supported logs to FortiAnalyzer, allowing administrators to perform historical investigations, security analysis, and reporting from a centralized platform. DHCP Server provides client network configuration, IP pools support source NAT, and ECMP manages equal-cost routing paths. FortiAnalyzer is therefore the appropriate platform when FortiGate logs need to be centrally collected and analyzed.

Question 291. Which FortiGate feature can authenticate users against a centralized RADIUS authentication server?

1. RADIUS server configuration
2. Virtual IP
3. Web Filter
4. Loopback interface

Correct Answer: 1. RADIUS server configuration

Explanation :-

FortiGate can be configured as a RADIUS client and communicate with an external RADIUS server for authentication. This allows centralized authentication infrastructure to validate user credentials and can support identity-based access according to the FortiGate configuration. Virtual IPs provide destination NAT, Web Filter controls website access, and loopback interfaces provide logical network endpoints. RADIUS server configuration is therefore the appropriate feature when FortiGate needs to authenticate users through an external RADIUS service.

Question 292. Which FortiGate feature can inspect active sessions to help determine the source, destination, and policy associated with current traffic?

1. diagnose sys session list
2. get system performance status
3. execute ping
4. show system dns

Correct Answer: 1. diagnose sys session list

Explanation :-

The diagnose sys session list command displays active sessions tracked by FortiGate. The output can provide useful information about source and destination addresses, interfaces, protocols, session state, and related policy information. This makes it valuable when investigating established or partially established connections. System performance status focuses on resource utilization, ping tests connectivity, and DNS configuration commands display name-resolution settings. The session-list command is therefore the appropriate diagnostic tool for examining current firewall sessions.

Question 293. Which FortiGate feature can enforce a time-based restriction so that a firewall policy is active only during specified hours?

1. Schedule
2. Address group
3. Service group
4. IP pool

Correct Answer: 1. Schedule

Explanation :-

A firewall policy schedule defines the times during which that policy is active. Administrators can configure recurring schedules for particular days and hours, allowing network access to be controlled according to business or operational requirements. Address groups combine network addresses, service groups combine services, and IP pools provide source NAT addresses. A schedule is therefore the appropriate feature when administrators need to enforce a time-based access restriction without creating separate policies for every individual time period.

Question 294. Which FortiGate feature can inspect network traffic for known vulnerabilities and exploit signatures?

1. DNS Filter
2. IPS
3. DHCP relay
4. Traffic shaping

Correct Answer: 2. IPS

Explanation :-

The Intrusion Prevention System uses signatures and detection mechanisms to identify known attacks, exploits, and suspicious network activity. When an IPS profile is applied to a firewall policy, FortiGate can log or block detected threats according to the configured action. DNS Filter evaluates DNS requests, DHCP relay forwards DHCP traffic, and Traffic Shaping controls bandwidth. IPS is therefore the appropriate security feature when the objective is to detect and prevent traffic associated with known vulnerabilities or attack patterns.

Question 295. Which FortiGate feature can provide a stable logical IP address that is not directly tied to the operational status of a physical interface?

1. Loopback interface
2. Virtual IP
3. Service group
4. IP pool

Correct Answer: 1. Loopback interface

Explanation :-

A loopback interface is a logical interface that remains independent of the physical state of individual network ports. Its address can be used as a stable endpoint for management, routing protocols, monitoring, or other services. A virtual IP performs destination NAT, a service group combines service definitions, and an IP pool provides addresses for source NAT. A loopback interface is therefore useful when a persistent logical address is required regardless of changes to physical interface connectivity.

Question 296. Which FortiGate feature can control access to websites according to categories such as social networking, malware, or newly observed domains?

1. Web Filter
2. ECMP
3. Static route
4. HA heartbeat

Correct Answer: 1. Web Filter

Explanation :-

Web Filter can use FortiGuard categorization and reputation information to classify websites and apply configured actions. Administrators can control categories according to organizational requirements, including blocking, monitoring, or allowing selected classifications. ECMP provides multiple equal-cost routes, static routes define forwarding paths, and HA heartbeat communication supports cluster operation. Web Filter is therefore the appropriate security feature when website access needs to be controlled based on categories or reputation information.

Question 297. Which FortiGate feature can provide authentication through a web portal before allowing users to access the network?

1. Captive portal
2. Static route
3. Address object
4. IP pool

Correct Answer: 1. Captive portal

Explanation :-

A captive portal requires users to authenticate through a web-based portal before they receive the configured level of network access. It is commonly used in guest networks and other environments where user identity must be established before normal access is permitted. Static routes control forwarding, address objects identify network endpoints, and IP pools provide addresses for source NAT. Captive portal is therefore the appropriate FortiGate feature when authentication should occur through a browser-based login page before access is granted.

Question 298. Which FortiGate feature can use multiple equal-cost routes to provide path redundancy or distribute traffic across available paths?

1. ECMP
2. Antivirus
3. Application Control
4. DHCP server

Correct Answer: 1. ECMP

Explanation :-

Equal-Cost Multi-Path routing allows FortiGate to use multiple routes that have equivalent routing characteristics. This can provide redundancy and, depending on the configured behavior, distribute traffic among multiple available paths. Antivirus scans supported traffic for malware, Application Control identifies applications, and DHCP Server provides client network configuration. ECMP is therefore the appropriate routing feature when several equivalent forwarding paths are available and FortiGate should be able to use them.

Question 299. Which FortiGate feature can restrict administrative access by allowing only specific trusted source networks to connect to an administrator account?

1. Trusted hosts
2. Web Filter
3. Security profile group
4. Service group

Correct Answer: 1. Trusted hosts

Explanation :-

Trusted hosts allow administrators to restrict where an administrator account can be used to access FortiGate management services. By specifying trusted source addresses or networks, organizations can limit management access to designated administrative locations. Web Filter controls web traffic, security profile groups combine security inspection profiles, and service groups combine service definitions. Trusted hosts are therefore the appropriate security mechanism when administrative access should be limited to specific source networks or management workstations.

Question 300. A firewall policy allows a service, but FortiGate still cannot forward the traffic because there is no valid route to the destination. Which two areas should be checked first?

1. Web Filter and Antivirus
2. Routing table and firewall policy
3. DHCP reservation and DNS Filter
4. Application Control and traffic shaping

Correct Answer: 2. Routing table and firewall policy

Explanation :-

Successful traffic forwarding through FortiGate requires both an appropriate firewall policy and a valid routing path. The firewall policy determines whether the traffic is permitted based on interfaces, addresses, services, schedules, and related settings, while the routing table determines where permitted traffic is forwarded. Security profiles may affect inspection but do not replace routing. DHCP reservations, DNS Filter, Application Control, and traffic shaping address other functions. Therefore, the routing table and firewall policy should be examined together when permitted traffic cannot reach its destination.